* Re: [PATCH 1/1] ovpn: tcp - defer TX from softirq to workqueue
From: Jakub Kicinski @ 2026-05-01 23:12 UTC (permalink / raw)
To: Dao Zhong Ma
Cc: linux-kernel, netdev, antonio, sd, andrew+netdev, davem, edumazet,
pabeni
In-Reply-To: <20260501145425.757147-2-cz1346219@gmail.com>
On Fri, 1 May 2026 22:54:25 +0800 Dao Zhong Ma wrote:
> ovpn_tcp_send_skb() holds sk->sk_lock.slock while performing the full TCP
> send in softirq context. This can hold the spinlock for a long time
> (large skb), blocking lock_sock() users. This can starve the RCU GP
> kthread and trigger RCU stalls warnings and hung tasks.
>
> Defer the TCP send operation to process context:
> - In interrupt context, only enqueue the skb under the spinlock
> schedule tcp_tx_work.
> - In process context, dequeue and flush the send queue under lock_sock()
>
> This reduces the softirq critical section to a short duration, allowing
> lock_sock() users to make progress and preventing RCU stalls.
This appears to break the ovpn selftests
^ permalink raw reply
* [PATCH net v1] net/mlx5: Fix flow steering alloc unwind
From: Prathamesh Deshpande @ 2026-05-01 23:20 UTC (permalink / raw)
To: Saeed Mahameed, Leon Romanovsky, Tariq Toukan
Cc: mbloch, shayd, andrew+netdev, davem, edumazet, kuba, pabeni,
netdev, linux-rdma, linux-kernel, Prathamesh Deshpande
mlx5_fs_core_alloc() uses mlx5_fs_core_free() for its common error path,
but mlx5_fs_core_free() dereferences dev->priv.steering.
If mlx5_ft_pool_init() fails, or if allocating the steering object fails,
dev->priv.steering has not been assigned yet. The error path can then
dereference NULL while unwinding the original failure.
Split the unwind paths so only resources that were successfully
initialized are released.
Fixes: b33886971dbc ("net/mlx5: Initialize flow steering during driver probe")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
---
.../net/ethernet/mellanox/mlx5/core/fs_core.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 61a6ba1e49dd..e1662dcedbf4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -3984,12 +3984,12 @@ int mlx5_fs_core_alloc(struct mlx5_core_dev *dev)
err = mlx5_ft_pool_init(dev);
if (err)
- goto err;
+ goto err_fc_stats;
steering = kzalloc_obj(*steering);
if (!steering) {
err = -ENOMEM;
- goto err;
+ goto err_ft_pool;
}
steering->dev = dev;
@@ -4011,13 +4011,19 @@ int mlx5_fs_core_alloc(struct mlx5_core_dev *dev)
0, NULL);
if (!steering->ftes_cache || !steering->fgs_cache) {
err = -ENOMEM;
- goto err;
+ goto err_fs_core;
}
return 0;
-err:
- mlx5_fs_core_free(dev);
+err_fs_core:
+ kmem_cache_destroy(steering->ftes_cache);
+ kmem_cache_destroy(steering->fgs_cache);
+ kfree(steering);
+err_ft_pool:
+ mlx5_ft_pool_destroy(dev);
+err_fc_stats:
+ mlx5_cleanup_fc_stats(dev);
return err;
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH 1/2] nfc: llcp: Fix use-after-free in llcp_sock_release()
From: Jakub Kicinski @ 2026-05-01 23:27 UTC (permalink / raw)
To: Lee Jones, David Heidelberg
Cc: David S. Miller, Eric Dumazet, Paolo Abeni, Simon Horman,
Kuniyuki Iwashima, Kees Cook, Junxi Qian, Ingo Molnar,
Samuel Ortiz, netdev, linux-kernel
In-Reply-To: <20260429134115.3558604-1-lee@kernel.org>
On Wed, 29 Apr 2026 13:40:41 +0000 Lee Jones wrote:
> llcp_sock_release() unconditionally unlinks the socket from the local
> sockets list. However, if the socket is still in connecting state, it
> is on the connecting list.
>
> Fix this by checking the socket state and unlinking from the correct list.
>
> Fixes: b4011239a08e ("NFC: llcp: Fix non blocking sockets connections")
> Signed-off-by: Lee Jones <lee@kernel.org>
Adding David H and dropping from netdev's patchwork..
^ permalink raw reply
* Re: [PATCH net] ipv6: rpl: add NULL check for idev in ipv6_rpl_srh_rcv()
From: Andrea Mayer @ 2026-05-01 23:35 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, David Ahern, Jakub Kicinski, Paolo Abeni,
Simon Horman, Alexander Aring, Justin Iurman, netdev,
linux-kernel, stable, stefano.salsano, Andrea Mayer
In-Reply-To: <CANn89i+dSEkqgbvsonrC5V=e-vnMPVNdVnD+0KdkkAxM_kxEQw@mail.gmail.com>
On Tue, 28 Apr 2026 17:24:05 -0700
Eric Dumazet <edumazet@google.com> wrote:
> On Tue, Apr 28, 2026 at 3:48 PM Andrea Mayer <andrea.mayer@uniroma2.it> wrote:
> > [snip]
> > diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
> > index 03cbce842c1a..e398a8851031 100644
> > --- a/net/ipv6/exthdrs.c
> > +++ b/net/ipv6/exthdrs.c
> > @@ -499,6 +499,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
> > u32 r;
> >
> > idev = __in6_dev_get(skb->dev);
> > + if (!idev) {
> > + kfree_skb(skb);
>
> I suggest:
>
> kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED)
Hi Eric,
Thanks for the suggestion. I will include it in v2.
Andrea
^ permalink raw reply
* Re: [PATCH net-next 1/5] ionic: Small improvements in devcmd retry logic
From: Jakub Kicinski @ 2026-05-01 23:37 UTC (permalink / raw)
To: Eric Joyner
Cc: netdev, Brett Creeley, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni
In-Reply-To: <20260501031555.43259-2-eric.joyner@amd.com>
On Thu, 30 Apr 2026 20:15:51 -0700 Eric Joyner wrote:
> If the timeout time is hit when the last attempt returned EAGAIN, the
> driver returns -ETIMEDOUT. This causes the -EAGAIN result to be lost.
> Fix this by returning -EAGAIN if the timeout time is hit and the
> previous result matches.
>
> Also, reduce the sleep between the write to done and doorbell
> registers. The msleep(1000) was initially added in an arbitrary
> manner. However, this long of a sleep is problematic because
> it reduces the number of retries when -EAGAIN is returned, which
> may result in the devmcd giving up early due to the timeout. Fix
> this by reducing the sleep to msleep(50).
It would be useful to explain the significance of the return value
to the callers. Are you trying to return EAGAIN to user space?
Or some kernel-internal function catches this?
^ permalink raw reply
* Re: [PATCH net-next 2/5] ionic: Report "link_down_events_phy" in ethtool statistics
From: Jakub Kicinski @ 2026-05-01 23:39 UTC (permalink / raw)
To: Eric Joyner
Cc: netdev, Brett Creeley, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni
In-Reply-To: <20260501031555.43259-3-eric.joyner@amd.com>
On Thu, 30 Apr 2026 20:15:52 -0700 Eric Joyner wrote:
> The number of times that link has gone down at the port level is tracked
> by the firmware and sent to the driver via regular DMA writes to an
> instance of struct ionic_port_status in the driver's memory.
>
> This statistic was never reported, but it is useful for diagnostics, so
> add it to the "ethtool -S` stats output, grouped with the other
> port-level stats that are contained in struct ionic_port_stats.
We have a standard stat for this:
struct ethtool_link_ext_stats {
/* Custom Linux statistic for PHY level link down events.
* In a simpler world it should be equal to netdev->carrier_down_count
* unfortunately netdev also counts local reconfigurations which don't
* actually take the physical link down, not to mention NC-SI which,
* if present, keeps the link up regardless of host state.
* This statistic counts when PHY _actually_ went down, or lost link.
*
* Note that we need u64 for ethtool_stats_init() and comparisons
* to ETHTOOL_STAT_NOT_SET, but only u32 is exposed to the user.
*/
u64 link_down_events;
};
IOW the definition of this stat is - ignoring asymetric link faults
this counter should match between link partners.
^ permalink raw reply
* Re: [PATCH net-next 3/5] ionic: Update ionic_if.h with new extra port stats structure
From: Jakub Kicinski @ 2026-05-01 23:40 UTC (permalink / raw)
To: Eric Joyner
Cc: netdev, Brett Creeley, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni
In-Reply-To: <20260501031555.43259-4-eric.joyner@amd.com>
On Thu, 30 Apr 2026 20:15:53 -0700 Eric Joyner wrote:
> @@ -2951,6 +2959,7 @@ union ionic_port_identity {
> * @sprom_page17: Extended Transceiver sprom, page 17
> * @rsvd: reserved byte(s)
> * @pb_stats: uplink pb drop stats
Looks like the removed field is left behind in the doc?
> + * @extra_stats: Extra port statistics data
> */
> struct ionic_port_info {
> union ionic_port_config config;
> @@ -2968,9 +2977,7 @@ struct ionic_port_info {
> };
> };
> u8 rsvd[376];
> -
> - /* pb_stats must start at 2k offset */
> - struct ionic_port_pb_stats pb_stats;
> + struct ionic_port_extra_stats extra_stats;
> };
^ permalink raw reply
* Re: [PATCH net-next 5/5] ionic: Add .get_fec_stats ethtool handler
From: Jakub Kicinski @ 2026-05-01 23:41 UTC (permalink / raw)
To: Eric Joyner
Cc: netdev, Brett Creeley, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni
In-Reply-To: <20260501031555.43259-6-eric.joyner@amd.com>
On Thu, 30 Apr 2026 20:15:55 -0700 Eric Joyner wrote:
> Several FEC error statistics being collected can be reported in a
> dedicated ethtool callback for FEC errors, so implement the handler that
> does so. This includes 802.3ck FEC histogram data that some newer
> hardware collects.
sparse says:
drivers/net/ethernet/pensando/ionic/ionic_ethtool.c:449:37: warning: incorrect type in assignment (different base types)
drivers/net/ethernet/pensando/ionic/ionic_ethtool.c:449:37: expected unsigned long long [usertype] sum
drivers/net/ethernet/pensando/ionic/ionic_ethtool.c:449:37: got restricted __le64 const
^ permalink raw reply
* Re: [PATCH net] ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
From: Jakub Kicinski @ 2026-05-01 23:42 UTC (permalink / raw)
To: HACKE-RC
Cc: David S . Miller, Eric Dumazet, Paolo Abeni, Simon Horman,
Alexander Aring, netdev, linux-kernel
In-Reply-To: <20260501063242.2523620-1-rc@rexion.ai>
On Fri, 1 May 2026 12:02:42 +0530 HACKE-RC wrote:
> From: HACKE-RC <rc@rexion.ai>
We need a real name, if you don't want to provide one please feel free
to send just the bug report and one of the maintainers will generate
the patch. Code is cheap these days.
^ permalink raw reply
* Re: [PATCH net 01/14] netfilter: replace skb_try_make_writable() by skb_ensure_writable()
From: patchwork-bot+netdevbpf @ 2026-05-01 23:50 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: netfilter-devel, davem, netdev, kuba, pabeni, edumazet, fw, horms
In-Reply-To: <20260501122237.296262-2-pablo@netfilter.org>
Hello:
This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:
On Fri, 1 May 2026 14:22:24 +0200 you wrote:
> skb_try_make_writable() only works on clones and uncloned packets might
> have their network header in paged fragments.
>
> nft_fwd needs to work for the ingress and egress hooks, but the egress
> hook where skb->data points to the mac header, use skb_network_offset()
> to include the mac header. The flowtable is fine since it already uses
> the transport offset.
>
> [...]
Here is the summary with links:
- [net,01/14] netfilter: replace skb_try_make_writable() by skb_ensure_writable()
https://git.kernel.org/netdev/net/c/1049970d7583
- [net,02/14] netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding
https://git.kernel.org/netdev/net/c/0a0b35f0bf10
- [net,03/14] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
https://git.kernel.org/netdev/net/c/1d47b55b36d2
- [net,04/14] netfilter: x_tables: add .check_hooks to matches and targets
https://git.kernel.org/netdev/net/c/6813985ca456
- [net,05/14] netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate
https://git.kernel.org/netdev/net/c/2f768d638d97
- [net,06/14] netfilter: xt_CT: fix usersize for v1 and v2 revision
https://git.kernel.org/netdev/net/c/8bedb6c46945
- [net,07/14] netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables
https://git.kernel.org/netdev/net/c/63bac0278603
- [net,08/14] netfilter: nf_socket: skip socket lookup for non-first fragments
https://git.kernel.org/netdev/net/c/0bf00859d7a5
- [net,09/14] netfilter: nf_tables: skip L4 header parsing for non-first fragments
https://git.kernel.org/netdev/net/c/009d203e56db
- [net,10/14] netfilter: xtables: fix L4 header parsing for non-first fragments
https://git.kernel.org/netdev/net/c/952e121c9613
- [net,11/14] netfilter: flowtable: ensure sufficient headroom in xmit path
https://git.kernel.org/netdev/net/c/ef4f741e8627
- [net,12/14] netfilter: flowtable: fix inline vlan encapsulation in xmit path
https://git.kernel.org/netdev/net/c/a177ae30f786
- [net,13/14] netfilter: flowtable: fix inline pppoe encapsulation in xmit path
https://git.kernel.org/netdev/net/c/69c54f80f4a7
- [net,14/14] netfilter: flowtable: use skb_pull_rcsum() to pop vlan/pppoe header
https://git.kernel.org/netdev/net/c/baa3c65435fb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: usb: r8152: add TRENDnet TUC-ET2G v2.0
From: Jakub Kicinski @ 2026-05-01 23:51 UTC (permalink / raw)
To: Birger Koblitz
Cc: Aleksander Jan Bajkowski, andrew+netdev, davem, edumazet, pabeni,
hayeswang, hsu.chih.kai, kees, linux-usb, netdev, linux-kernel,
Andrew Lunn
In-Reply-To: <7b3d3fc6-bbed-4a75-ac19-33fa910359c9@birger-koblitz.de>
On Fri, 1 May 2026 06:03:05 +0200 Birger Koblitz wrote:
> On 30/04/2026 11:34 pm, Aleksander Jan Bajkowski wrote:
> > The TRENDnet TUC-ET2G V2.0 is an RTL8156B based 2.5G Ethernet controller.
> >
> > Add the vendor and product ID values to the driver. This makes Ethernet
> > work with the adapter.
> >
> > Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
> > Reviewed-by: Andrew Lunn <andrew@lunn.ch>
> > ---
> > drivers/net/usb/r8152.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
> > index 7337bf1b7d6a..1ace1d2398c9 100644
> > --- a/drivers/net/usb/r8152.c
> > +++ b/drivers/net/usb/r8152.c
> > @@ -10138,6 +10138,7 @@ static const struct usb_device_id rtl8152_table[] = {
> > { USB_DEVICE(VENDOR_ID_TRENDNET, 0xe02b) },
> > + { USB_DEVICE(VENDOR_ID_TRENDNET, 0xe02c) },
> >
> You may also add my Reviewed-by: Birger Koblitz <mail@birger-koblitz.de>
Thanks! In the future please make sure you send the Review tags on a
separate line, otherwise our scripts don't pick them up
^ permalink raw reply
* Re: [PATCH] kcov: refactor common handle ID into kcov_common_handle_id
From: Jakub Kicinski @ 2026-05-01 23:52 UTC (permalink / raw)
To: Jann Horn
Cc: Dmitry Vyukov, Andrey Konovalov, kasan-dev, Andrew Morton,
Alexander Potapenko, Valentina Manea, Shuah Khan, Shuah Khan,
Hongren Zheng, linux-usb, Michael S. Tsirkin, Jason Wang,
Eugenio Pérez, kvm, virtualization, netdev, linux-kernel
In-Reply-To: <20260430-kcov-refactor-common-handle-v1-1-23a0c7a0ba38@google.com>
On Thu, 30 Apr 2026 16:15:33 +0200 Jann Horn wrote:
> Store common handle IDs in "struct kcov_common_handle_id", which consumes
> no space in non-KCOV builds.
> This cleanup removes #ifdef boilerplate code from subsystems that
> integrate with KCOV (in particular in usbip_common.h and skbuff.h, see the
> diffstat).
> This should also make it easier to add KCOV remote coverage to more
> subsystems in the future.
>
> Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
^ permalink raw reply
* Re: [PATCH net v2] psp: strip variable-length PSP header in psp_dev_rcv()
From: Jakub Kicinski @ 2026-05-02 0:00 UTC (permalink / raw)
To: David Carlier
Cc: daniel.zahka, willemdebruijn.kernel, davem, edumazet, pabeni,
horms, raeds, kees, cratiu, netdev, linux-kernel, stable
In-Reply-To: <20260501130046.16008-1-devnexen@gmail.com>
On Fri, 1 May 2026 14:00:46 +0100 David Carlier wrote:
> + psp_hdr_len = ((u32)psph->hdrlen + 1) * 8;
nit: psp_hlen ? all the other header lengths in this function use hlen
^ permalink raw reply
* Re: [PATCH net v2] psp: strip variable-length PSP header in psp_dev_rcv()
From: Jakub Kicinski @ 2026-05-02 0:00 UTC (permalink / raw)
To: Daniel Zahka
Cc: David Carlier, willemdebruijn.kernel, davem, edumazet, pabeni,
horms, raeds, kees, cratiu, netdev, linux-kernel, stable
In-Reply-To: <ba78786c-881e-4cf4-91d1-7e9d21194454@gmail.com>
On Fri, 1 May 2026 10:13:52 -0400 Daniel Zahka wrote:
> nit: int psp_hlen might be more consistent with the types/names of the
> other local vars.
Ah. :)
^ permalink raw reply
* Re: [PATCH net] ipmr: prevent info-leak in pmr_cache_report()
From: patchwork-bot+netdevbpf @ 2026-05-02 0:10 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, idosch, dsahern, horms, netdev, eric.dumazet,
yimingqian591
In-Reply-To: <20260430070611.4004529-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 30 Apr 2026 07:06:11 +0000 you wrote:
> Yiming Qian reported:
>
> <quote>
> ipmr_cache_report()` allocates a report skb with `alloc_skb(128,
> GFP_ATOMIC)` and appends a `struct igmphdr` using `skb_put()`. In the
> non-`IGMPMSG_WHOLEPKT` path it initializes only:
>
> [...]
Here is the summary with links:
- [net] ipmr: prevent info-leak in pmr_cache_report()
https://git.kernel.org/netdev/net/c/4f34002e2e37
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v3] net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
From: patchwork-bot+netdevbpf @ 2026-05-02 0:10 UTC (permalink / raw)
To: Kai Aizen; +Cc: netdev, stable, edumazet, davem, kuba, pabeni, horms, gregkh
In-Reply-To: <3c506e8f936e52b57620269b55c348af05d413a2.1777557228.git.kai.aizen.dev@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 30 Apr 2026 18:26:48 +0300 you wrote:
> rtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack
> without initialisation:
>
> struct ifla_vf_broadcast vf_broadcast;
>
> The struct contains a single fixed 32-byte field:
>
> [...]
Here is the summary with links:
- [net,v3] net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
https://git.kernel.org/netdev/net/c/4b9e32799181
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: usb: r8152: add TRENDnet TUC-ET2G v2.0
From: patchwork-bot+netdevbpf @ 2026-05-02 0:10 UTC (permalink / raw)
To: Aleksander Jan Bajkowski
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, hayeswang,
hsu.chih.kai, kees, mail, linux-usb, netdev, linux-kernel, andrew
In-Reply-To: <20260430213435.21821-1-olek2@wp.pl>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 30 Apr 2026 23:34:33 +0200 you wrote:
> The TRENDnet TUC-ET2G V2.0 is an RTL8156B based 2.5G Ethernet controller.
>
> Add the vendor and product ID values to the driver. This makes Ethernet
> work with the adapter.
>
> Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
> Reviewed-by: Andrew Lunn <andrew@lunn.ch>
>
> [...]
Here is the summary with links:
- [net-next] net: usb: r8152: add TRENDnet TUC-ET2G v2.0
https://git.kernel.org/netdev/net/c/f93836b23677
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: cs89x0: remove ISA bus probing
From: patchwork-bot+netdevbpf @ 2026-05-02 0:10 UTC (permalink / raw)
To: Arnd Bergmann
Cc: davem, edumazet, kuba, pabeni, corbet, andrew+netdev, arnd, akpm,
horms, skhan, mengyuanlou, netdev, linux-doc, linux-kernel
In-Reply-To: <20260429145624.2948432-1-arnd@kernel.org>
Hello:
This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 16:55:45 +0200 you wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> The cs89x0 driver is really two in one, and they are mutually exclusive:
>
> - the ISA driver was used on 486-era PCs. It likely has no remaining
> users, like the other ethernet drivers that got removed in
> linux-7.1. The DMA support in here is the last device driver use of
> the deprecated isa_bus_to_virt() interface, all other users are either
> x86 specific or or got converted to the normal dma-mapping interface.
> The driver was maintained by Andrew Morton at the time, based on
> the linux-2.2 vendor driver from Cirrus Logic.
>
> [...]
Here is the summary with links:
- [net-next,1/2] net: cs89x0: remove ISA bus probing
https://git.kernel.org/netdev/net-next/c/93cda0c120ac
- [net-next,2/2] ne2k: fold drivers/net/Space.c into ne.c
https://git.kernel.org/netdev/net-next/c/4fe18ddd17d8
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: tls: reshuffle the device ops check
From: patchwork-bot+netdevbpf @ 2026-05-02 0:10 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms,
john.fastabend, sd
In-Reply-To: <20260429213001.1908235-1-kuba@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 14:30:01 -0700 you wrote:
> We try to validate during registration that the netdev
> has ops if it has features. This is currently somewhat sillily
> written because we have a dereference before a NULL check
> on the ops struct. Straighten this out.
>
> No functional change intended other than saving ourselves
> the very theoretical crash with a bad driver.
>
> [...]
Here is the summary with links:
- [net-next] net: tls: reshuffle the device ops check
https://git.kernel.org/netdev/net-next/c/fa11b4048013
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] ip6mr: plug drop_reason to ip6mr_cache_report()
From: patchwork-bot+netdevbpf @ 2026-05-02 0:10 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, idosch, dsahern, horms, netdev, eric.dumazet
In-Reply-To: <20260430074004.4133602-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 30 Apr 2026 07:40:04 +0000 you wrote:
> - Check mrt->mroute_sk earlier in the function.
>
> - Use sock_queue_rcv_skb_reason() instead of sock_queue_rcv_skb().
> - Use sk_skb_reason_drop() instead of kfree_skb().
> Note that we return -ENOMEM if sock_queue_rcv_skb_reason() failed,
> as the precise error is not really needed for callers.
>
> [...]
Here is the summary with links:
- [net-next] ip6mr: plug drop_reason to ip6mr_cache_report()
https://git.kernel.org/netdev/net-next/c/8d59a7a188c0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v5] net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
From: Jakub Kicinski @ 2026-05-02 0:15 UTC (permalink / raw)
To: daniel
Cc: Jakub Kicinski, chester.a.unal, andrew, olteanv, davem, edumazet,
pabeni, matthias.bgg, angelogioacchino.delregno, linux,
ansuelsmth, netdev, linux-kernel, linux-arm-kernel,
linux-mediatek
In-Reply-To: <4086098f5333d48221f83fa775607330836336d7.1777590741.git.daniel@makrotopia.org>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
Subject: net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
This patch moves MIB counter reads for MDIO-connected switches into a
self-rearming delayed work, and has .get_stats64 return cached values
under a spinlock. A mod_delayed_work() call on each read triggers an
immediate refresh.
> diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
> index b9423389c2ef..e769914d726c 100644
> --- a/drivers/net/dsa/mt7530.c
> +++ b/drivers/net/dsa/mt7530.c
[ ... ]
> @@ -3137,6 +3187,12 @@ mt753x_setup(struct dsa_switch *ds)
> if (ret && priv->irq_domain)
> mt7530_free_mdio_irq(priv);
>
> + if (!ret && priv->bus) {
> + mt7530_stats_refresh(priv);
> + schedule_delayed_work(&priv->stats_work,
> + MT7530_STATS_POLL_INTERVAL);
> + }
> +
> return ret;
> }
Can the delayed work outlive priv on a probe failure path?
mt753x_setup() is installed as ds->ops->setup and is invoked from
dsa_register_switch() via:
dsa_register_switch()
dsa_switch_probe()
dsa_tree_setup()
dsa_tree_setup_switches()
dsa_switch_setup()
ds->ops->setup == mt753x_setup() /* queues stats_work */
dsa_tree_setup_ports() /* may fail here */
dsa_tree_setup_conduit() /* or here */
dsa_tree_setup_lags() /* or here */
If any of the later dsa_tree_setup_* steps fail after mt753x_setup()
has queued stats_work, dsa_tree_teardown_switches() is called, which
invokes ds->ops->teardown per switch. The mt7530 dsa_switch_ops does
not define a .teardown op, so nothing cancels the delayed work.
mt7530_probe() then propagates the error. The driver core does not
invoke .remove() after a failed probe, so mt7530_remove_common()
(which holds the cancel_delayed_work_sync()) never runs. Once
mt7530_probe() returns the error, devres releases priv and priv->ds
while stats_work is still queued. When it fires, mt7530_stats_poll()
dereferences priv, walks priv->ds->dst->ports and issues MDIO reads
via priv->bus on freed memory.
Would it be safer to cancel the work in mt753x_setup()'s own error
path (and/or add a .teardown op) so the work is stopped whenever
setup reports failure?
> @@ -3409,6 +3468,9 @@ mt7530_remove_common(struct mt7530_priv *priv)
>
> dsa_unregister_switch(priv->ds);
>
> + if (priv->bus)
> + cancel_delayed_work_sync(&priv->stats_work);
> +
> mutex_destroy(&priv->reg_mutex);
> }
Is the ordering of dsa_unregister_switch() vs. cancel_delayed_work_sync()
correct here?
dsa_unregister_switch() ends up in dsa_switch_remove():
net/dsa/dsa.c:
static void dsa_switch_remove(struct dsa_switch *ds)
{
struct dsa_switch_tree *dst = ds->dst;
dsa_tree_teardown(dst);
dsa_switch_release_ports(ds);
dsa_tree_put(dst);
}
and dsa_switch_release_ports() does list_del + kfree on every
dsa_port entry:
dsa_switch_for_each_port_safe(dp, next, ds) {
...
list_del(&dp->list);
kfree(dp);
}
Meanwhile, mt7530_stats_refresh() iterates the same list without any
locking or RCU:
dsa_switch_for_each_user_port(dp, priv->ds) {
port = dp->index;
mt7530_read_port_stats64(priv, port, &stats);
...
}
and dsa_switch_for_each_user_port expands to a plain
list_for_each_entry over ds->dst->ports.
stats_work rearms itself every MT7530_STATS_POLL_INTERVAL (one
second), and mt7530_get_stats64() can mod_delayed_work(..., 0) it to
fire immediately. With the cancel happening after
dsa_unregister_switch(), the worker can run concurrently with port
teardown and dereference dsa_port entries that have already been
list_del'd and kfree'd, or walk priv->ds->dst after dsa_tree_put()
has released it.
Should cancel_delayed_work_sync(&priv->stats_work) run before
dsa_unregister_switch(), with a guard to prevent mt7530_get_stats64()
from requeuing the work during unregister?
--
pw-bot: cr
^ permalink raw reply
* [PATCH net-next 1/4] net/sched: netem: move state enums out of struct netem_sched_data
From: Stephen Hemminger @ 2026-05-02 0:17 UTC (permalink / raw)
To: netdev
Cc: jhs, jiri, Stephen Hemminger, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman,
open list:NETEM NETWORK EMULATOR, open list
In-Reply-To: <20260502001844.19107-1-stephen@networkplumber.org>
The _4_state_model and GE_state_model enum definitions are declared
as struct members but are never read or written. Only the enum
constants they define (TX_IN_GAP_PERIOD, GOOD_STATE, etc.) are used.
Move them to file scope as anonymous enums and remove the unused
struct fields, saving 8 bytes per netem instance.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/sched/sch_netem.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index bc18e1976b6e..148b22fb3ca3 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -71,6 +71,18 @@ struct disttable {
s16 table[] __counted_by(size);
};
+enum GE_state_model {
+ GOOD_STATE = 1,
+ BAD_STATE,
+};
+
+enum _4_state_model {
+ TX_IN_GAP_PERIOD = 1,
+ TX_IN_BURST_PERIOD,
+ LOST_IN_GAP_PERIOD,
+ LOST_IN_BURST_PERIOD,
+};
+
struct netem_sched_data {
/* internal t(ime)fifo qdisc uses t_root and sch->limit */
struct rb_root t_root;
@@ -121,18 +133,6 @@ struct netem_sched_data {
CLG_GILB_ELL,
} loss_model;
- enum {
- TX_IN_GAP_PERIOD = 1,
- TX_IN_BURST_PERIOD,
- LOST_IN_GAP_PERIOD,
- LOST_IN_BURST_PERIOD,
- } _4_state_model;
-
- enum {
- GOOD_STATE = 1,
- BAD_STATE,
- } GE_state_model;
-
/* Correlated Loss Generation models */
struct clgstate {
/* state of the Markov chain */
--
2.53.0
^ permalink raw reply related
* [PATCH net-next 2/4] net/sched: netem: remove useless VERSION
From: Stephen Hemminger @ 2026-05-02 0:17 UTC (permalink / raw)
To: netdev
Cc: jhs, jiri, Stephen Hemminger, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman,
open list:NETEM NETWORK EMULATOR, open list
In-Reply-To: <20260502001844.19107-1-stephen@networkplumber.org>
The version printed was never updated and kernel version is
better indication of what is fixed or not.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/sched/sch_netem.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 148b22fb3ca3..9ce75d9b8c54 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -27,8 +27,6 @@
#include <net/pkt_sched.h>
#include <net/inet_ecn.h>
-#define VERSION "1.3"
-
/* Network Emulation Queuing algorithm.
====================================
@@ -1410,16 +1408,15 @@ static struct Qdisc_ops netem_qdisc_ops __read_mostly = {
};
MODULE_ALIAS_NET_SCH("netem");
-
static int __init netem_module_init(void)
{
- pr_info("netem: version " VERSION "\n");
return register_qdisc(&netem_qdisc_ops);
}
static void __exit netem_module_exit(void)
{
unregister_qdisc(&netem_qdisc_ops);
}
+
module_init(netem_module_init)
module_exit(netem_module_exit)
MODULE_LICENSE("GPL");
--
2.53.0
^ permalink raw reply related
* [PATCH net-next 3/4] net/sched: netem: replace pr_info with netlink extack error messages
From: Stephen Hemminger @ 2026-05-02 0:17 UTC (permalink / raw)
To: netdev
Cc: jhs, jiri, Stephen Hemminger, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman,
open list:NETEM NETWORK EMULATOR, open list
In-Reply-To: <20260502001844.19107-1-stephen@networkplumber.org>
netem predates the netlink extended ack mechanism and uses pr_info()
to report configuration errors. These messages go to the kernel log
where the user running tc may never see them, and in unprivileged
user namespace contexts they can be used for log spam.
Replace pr_info() with NL_SET_ERR_MSG() and NL_SET_ERR_MSG_FMT()
which return error details to the caller via netlink. Thread the
extack pointer through parse_attr() and get_loss_clg(). Remove
the uninformative "netem: change failed" message from netem_init()
since the error is already propagated.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/sched/sch_netem.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 9ce75d9b8c54..116e96d79ddf 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -918,7 +918,8 @@ static void get_rate(struct netem_sched_data *q, const struct nlattr *attr)
q->cell_size_reciprocal = (struct reciprocal_value) { 0 };
}
-static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr)
+static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr,
+ struct netlink_ext_ack *extack)
{
const struct nlattr *la;
int rem;
@@ -931,7 +932,8 @@ static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr)
const struct tc_netem_gimodel *gi = nla_data(la);
if (nla_len(la) < sizeof(struct tc_netem_gimodel)) {
- pr_info("netem: incorrect gi model size\n");
+ NL_SET_ERR_MSG(extack,
+ "netem: incorrect gi model size");
return -EINVAL;
}
@@ -950,7 +952,8 @@ static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr)
const struct tc_netem_gemodel *ge = nla_data(la);
if (nla_len(la) < sizeof(struct tc_netem_gemodel)) {
- pr_info("netem: incorrect ge model size\n");
+ NL_SET_ERR_MSG(extack,
+ "netem: incorrect ge model size");
return -EINVAL;
}
@@ -964,7 +967,7 @@ static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr)
}
default:
- pr_info("netem: unknown loss type %u\n", type);
+ NL_SET_ERR_MSG_FMT(extack, "netem: unknown loss type %u", type);
return -EINVAL;
}
}
@@ -987,12 +990,14 @@ static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = {
};
static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
- const struct nla_policy *policy, int len)
+ const struct nla_policy *policy, size_t len,
+ struct netlink_ext_ack *extack)
{
int nested_len = nla_len(nla) - NLA_ALIGN(len);
if (nested_len < 0) {
- pr_info("netem: invalid attributes len %d\n", nested_len);
+ NL_SET_ERR_MSG_FMT(extack, "netem: invalid attributes len %u < %zu",
+ nla_len(nla), NLA_ALIGN(len));
return -EINVAL;
}
@@ -1041,8 +1046,7 @@ static int check_netem_in_tree(struct Qdisc *sch, bool duplicates,
}
/* Parse netlink message to set options */
-static int netem_change(struct Qdisc *sch, struct nlattr *opt,
- struct netlink_ext_ack *extack)
+static int netem_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack)
{
struct netem_sched_data *q = qdisc_priv(sch);
struct nlattr *tb[TCA_NETEM_MAX + 1];
@@ -1054,7 +1058,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
int ret;
qopt = nla_data(opt);
- ret = parse_attr(tb, TCA_NETEM_MAX, opt, netem_policy, sizeof(*qopt));
+ ret = parse_attr(tb, TCA_NETEM_MAX, opt, netem_policy, sizeof(*qopt), extack);
if (ret < 0)
return ret;
@@ -1094,7 +1098,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
old_loss_model = q->loss_model;
if (tb[TCA_NETEM_LOSS]) {
- ret = get_loss_clg(q, tb[TCA_NETEM_LOSS]);
+ ret = get_loss_clg(q, tb[TCA_NETEM_LOSS], extack);
if (ret) {
q->loss_model = old_loss_model;
q->clg = old_clg;
@@ -1190,8 +1194,6 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt,
prandom_seed_state(&q->prng.prng_state, q->prng.seed);
ret = netem_change(sch, opt, extack);
- if (ret)
- pr_info("netem: change failed\n");
return ret;
}
--
2.53.0
^ permalink raw reply related
* [PATCH net-next 4/4] netem: add per-impairment extended statistics
From: Stephen Hemminger @ 2026-05-02 0:17 UTC (permalink / raw)
To: netdev
Cc: jhs, jiri, Stephen Hemminger, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, open list:TC subsystem,
open list
In-Reply-To: <20260502001844.19107-1-stephen@networkplumber.org>
Adds new counters that keep track of when netem applied
impairments (delay, loss, corruption, duplication, reordering).
Add a struct tc_netem_xstats reported via TCA_STATS_APP so that
userspace (tc -s qdisc show) can display per-impairment counters.
Use the WRITE_ONCE/READ_ONCE pattern to allow for lockless
qdisc usage.
Accompanying iproute2 change is submitted separately.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
include/uapi/linux/pkt_sched.h | 9 ++++++++
net/sched/sch_netem.c | 40 +++++++++++++++++++++++++++++++---
2 files changed, 46 insertions(+), 3 deletions(-)
diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index 66e8072f44df..1c84c8076e22 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -569,6 +569,15 @@ struct tc_netem_gemodel {
#define NETEM_DIST_SCALE 8192
#define NETEM_DIST_MAX 16384
+struct tc_netem_xstats {
+ __u64 delayed; /* packets delayed */
+ __u64 dropped; /* packets dropped by loss model */
+ __u64 corrupted; /* packets with bit errors injected */
+ __u64 duplicated; /* duplicate packets generated */
+ __u64 reordered; /* packets sent out of order */
+ __u64 ecn_marked; /* packets ECN CE-marked (not dropped)*/
+};
+
/* DRR */
enum {
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 116e96d79ddf..c871c7a3b117 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -152,6 +152,14 @@ struct netem_sched_data {
} slot;
struct disttable *slot_dist;
+
+ /* Per-impairment counters */
+ __u64 delayed;
+ __u64 dropped;
+ __u64 corrupted;
+ __u64 duplicated;
+ __u64 reordered;
+ __u64 ecn_marked;
};
/* Time stamp put into socket buffer control block
@@ -459,17 +467,23 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
skb->prev = NULL;
/* Random duplication */
- if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng))
+ if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng)) {
++count;
+ WRITE_ONCE(q->duplicated, q->duplicated + 1);
+ }
/* Drop packet? */
if (loss_event(q)) {
- if (q->ecn && INET_ECN_set_ce(skb))
+ if (q->ecn && INET_ECN_set_ce(skb)) {
qdisc_qstats_drop(sch); /* mark packet */
- else
+ WRITE_ONCE(q->ecn_marked, q->ecn_marked + 1);
+ } else {
--count;
+ }
}
+
if (count == 0) {
+ WRITE_ONCE(q->dropped, q->dropped + 1);
qdisc_qstats_drop(sch);
__qdisc_drop(skb, to_free);
return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
@@ -495,6 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
* do it now in software before we mangle it.
*/
if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor, &q->prng)) {
+ WRITE_ONCE(q->corrupted, q->corrupted + 1);
if (skb_is_gso(skb)) {
skb = netem_segment(skb, sch, to_free);
if (!skb)
@@ -600,12 +615,15 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
cb->time_to_send = now + delay;
++q->counter;
+ WRITE_ONCE(q->delayed, q->delayed + 1);
+
tfifo_enqueue(skb, sch);
} else {
/*
* Do re-ordering by putting one out of N packets at the front
* of the queue.
*/
+ WRITE_ONCE(q->reordered, q->reordered + 1);
cb->time_to_send = ktime_get_ns();
q->counter = 0;
@@ -1344,6 +1362,21 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
return -1;
}
+static int netem_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
+{
+ struct netem_sched_data *q = qdisc_priv(sch);
+ struct tc_netem_xstats st = {
+ .delayed = READ_ONCE(q->delayed),
+ .dropped = READ_ONCE(q->dropped),
+ .corrupted = READ_ONCE(q->corrupted),
+ .duplicated = READ_ONCE(q->duplicated),
+ .reordered = READ_ONCE(q->reordered),
+ .ecn_marked = READ_ONCE(q->ecn_marked),
+ };
+
+ return gnet_stats_copy_app(d, &st, sizeof(st));
+}
+
static int netem_dump_class(struct Qdisc *sch, unsigned long cl,
struct sk_buff *skb, struct tcmsg *tcm)
{
@@ -1406,6 +1439,7 @@ static struct Qdisc_ops netem_qdisc_ops __read_mostly = {
.destroy = netem_destroy,
.change = netem_change,
.dump = netem_dump,
+ .dump_stats = netem_dump_stats,
.owner = THIS_MODULE,
};
MODULE_ALIAS_NET_SCH("netem");
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox